
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@nanocollective/nanocoder
Advanced tools
A local-first CLI coding agent that brings the power of agentic coding tools like Claude Code and Gemini CLI to local models or controlled APIs like OpenRouter
A local-first CLI coding agent built by the Nano Collective — a community collective building AI tooling not for profit, but for the community. Everything we build is open, transparent, and driven by the people who use it.
Nanocoder brings the power of agentic coding tools like Claude Code and Gemini CLI to local models or controlled APIs like OpenRouter. Built with privacy and control in mind, it supports multiple AI providers with tool support for file operations and command execution.

npm install -g @nanocollective/nanocoder
nanocoder
Also available via Homebrew and Nix Flakes.
Specify provider, model, and starting mode directly:
# Non-interactive mode with specific provider/model
nanocoder --provider openrouter --model google/gemini-3.1-flash run "analyze src/app.ts"
# Interactive mode starting with specific provider
nanocoder --provider ollama --model llama3.1
# Flags can appear before or after 'run' command
nanocoder run --provider openrouter "refactor database module"
# Boot directly into a development mode (normal, auto-accept, yolo, plan)
nanocoder --mode yolo
nanocoder --mode plan run "audit the auth module"
Full documentation is available online at docs.nanocollective.org or in the docs/ folder:
The Nano Collective is a community collective building AI tooling for the community, not for profit. We'd love your help.
FAQs
A local-first CLI coding agent that brings the power of agentic coding tools like Claude Code and Gemini CLI to local models or controlled APIs like OpenRouter
The npm package @nanocollective/nanocoder receives a total of 2,000 weekly downloads. As such, @nanocollective/nanocoder popularity was classified as popular.
We found that @nanocollective/nanocoder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.